Two WordPress Core Vulnerabilities Disclosed Without Patch: Sensitive Data Exposure and Stored XSS

Two WordPress core vulnerabilities were disclosed without a patch, impacting all versions up to and including 6.8.2 and involving sensitive data exposure and stored XSS. The first flaw, CVE-2025-58246, is classified as a Sensitive Information Exposure vulnerability and could allow authenticated users with Contributor-level access or higher to extract sensitive data, with WordPress confirming no official patch is yet available as of the disclosure.

The second issue, CVE-2025-58674, is a Stored Cross-Site Scripting vulnerability with a CVSS of 6.4, arising from insufficient input sanitisation and output escaping, allowing authenticated users with Author-level access or higher to inject arbitrary JavaScript. According to WordPress security team disclosures, the bugs were unintentionally revealed by a third‑party researcher and remain unpatched, though the current risk to site owners is considered low while mitigation work proceeds.

The article recommends measures such as restricting Contributor and Author access, monitoring user activity, hardening security plugins, and staying alert for patch releases. Disclosures were coordinated with the WordPress team, and both flaws are described as having potential privacy and information leakage risks in multi-user WordPress environments. 25 September 2025.